4 VoIP? Voice over IP (VoIP) protocols and technology is a merge of telecom and data communication What is VoIP? Broad definition: Sending and receiving media (voice/video) over IP Why VoIP? Added functionality and flexibility which may be hard to provide over PSTN Reduced cost uses Internet as carrier Less administration no separate telephone and data network Industry have high focus on VoIP today But, VoIP is known to be insecure Inherits problems from traditional IP networks Multiple attack on SIP based VoIP exists 4

5 SIP Session Initiation Protocol (SIP) is the de facto standard signaling protocol for VoIP Application layer (TCP, UDP, SCTP) Setting up, modifying and tearing down multimedia sessions Not media transfer (voice/video) Establishing and negotiating the context of a call RTP transfer the actual multimedia SIP specified in RFC 3261 published by IETF 2002 First iteration in 1999 (RFC2543) ten years old Additional functionality specified in over 120 different RFCs(!) Even more pending drafts... Known to be complex and sometimes vague difficult for software engineers to implement Interoperability conference - SIPit 5

6 SIP specification huge, complex and sometimes vague 6

7 Excerpts from an posted on IEFT RAI mailing list: I'm finally getting into SIP. I've got Speakeasy VoIP service, two sipphone accounts, a Cisco 7960 and a copy of x-ten on my Mac. And I still can't make it work. Voice flows in one direction only. I'm not even behind a NAT or firewall -- both machines have global addresses, with no port translations or firewalls. I've been working with Internet protocols for over 20 years. I've implemented and contributed to them. And if *I* can't figure out how to make this stuff work, how is the average grandmother expected to do so? SIP is unbelievably complex, with extraordinarily confusing terms. There must be half a dozen different "names" -- Display Name, User Name, Authorization User Name, etc -- and a dozen "proxies". Even the word "domain" is overloaded a half dozen different ways. This is ridiculous! Sorry. I just had to get this off my chest. Regards, Reference: 7

11 VoIP threat taxonomy* Social threats Eavesdropping A method by which an attacker is able to see the entire signaling and/or data stream, and can also modify the traffic Service abuse A method by which an attacker is able to monitor the entire signaling and/or data stream Interception and modification Balancing security and privacy. Unsolicited calls, intrusion of users privacy, fraud, identity theft and misrepresentation of identity or content A large category of improper use including fraud, improper bypass, billing fraud, bypassing authentication, call conference abuse,... Interruption of service Can be classified into general and VoIP specific Denial of Service (DoS), physical intrusion, resource exhaustion, loss of external power, performance latency. *) VoIP Security and Privacy Threat Taxonomy, VOIPSA (2005) 11

18 Service abuse Registration attack Weak/no password Example: Company X used the last three digits in the phone number as password SIP REGISTER with digest authentication example Misconfiguration Services not used Web-GUI default password Moore said what made the hacking job so easy was that 70% of all the companies he scanned were insecure, and 45% to 50% of VoIP providers were insecure. The biggest insecurity? Default passwords. 18

21 DDoS for sale Russian ad for launching DDoS VoIP attack against an competitor: The ad scrolls through several messages, including "Will eliminate competition: high-quality, reliable, anonymous." "Flooding of stationary and mobile phones." "Pleasant prices: 24-hours start at $80. Regular clients receive significant discounts." "Complete paralysis of your competitor/foe." Flooding of victims phones can be devastating SPIT can also turn out to be a major problem Reference: 21

26 Why so hard? Cryptography provides reasonable solutions to all known security problems Why then is security an issue at all? Security mechanisms are deployed partially or not at all VoIP uses multiple components in an already complex architecture 26

27 27

28 Highly relevant issue: Monitoring What do you use to monitor your infrastructure? Do you know what is going on? How much CPU load? Network utilization? Number of SIP calls at this moment? Do you know or do think you know? What tools do you use? Munin? Nagios? MRTG? 28

Voice over IP (SIP) Milan Milinković milez@sbox.tugraz.at 30.03.2007. Intoduction (1990s) a need for standard protocol which define how computers should connect to one another so they can share media and

Voice over IP VoIP (In) Security Presented by Darren Bilby NZISF 14 July 2005 Security-Assessment.com Who We Are NZ s only pure-play security firm Largest team of security professionals in NZ Offices in

Denial of Services on SIP VoIP infrastructures Ge Zhang Karlstad University ge.zhang@kau.se 1 Outline Background Denial of Service attack using DNS Conclusion 2 VoIP What is VoIP? What is its advantage?

VOICE OVER IP SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

Finding VoIP vulnerabilities while you sleep Background info on VoIP and previous research Introduction to VoIPER Description of some of its features Some demos and usage examples The results of my testing

SIP ALG is a parameter that is generally enabled on most commercial router because it helps to resolve NAT related problems. However, this parameter can be very harmful and can actually stop SIP Trunks

SIP: Protocol Overview NOTICE 2001 RADVISION Ltd. All intellectual property rights in this publication are owned by RADVISION Ltd. and are protected by United States copyright laws, other applicable copyright

A Brief Overview of VoIP Security By John McCarron Voice of Internet Protocol is the next generation telecommunications method. It allows to phone calls to be route over a data network thus saving money

25751 Secure Real-Time Transport Protocol on SoundPoint IP Phones This technical bulletin provides detailed information on how the SIP application has been enhanced to support Secure Real-Time Transport

What is Mobility? Spectrum of mobility, from the perspective: no mobility high mobility mobile wireless user, using same AP mobile user, (dis) connecting from using DHCP mobile user, passing through multiple

Session Initiation Protocol (SIP) The Emerging System in IP Telephony Introduction Session Initiation Protocol (SIP) is an application layer control protocol that can establish, modify and terminate multimedia

VoIP What s Voice over IP? Transmission of voice using IP Analog speech digitized and transmitted as IP packets Packets transmitted on top of existing networks Voice connection is now packet switched as

SS7 & LTE Stack Attack Ankit Gupta Black Hat USA 2013 akg0x11@gmail.com Introduction With the evolution of IP network, Telecom Industries are using it as their core mode of communication for their network

Encryption keys Symmetrical keys Same key used for encryption and decryption Exchange of symmetrical keys between parties difficult without risk of interception Asymmetrical keys One key for encryption

Security of VoIP Analysis, Testing and Mitigation of SIP-based DDoS attacks on VoIP Networks A thesis submitted in partial fulfilment of the requirements for the Degree of Master of Science in Computer

TECHNICAL OVERVIEW Session Initiation Protocol Author: James Wright, MSc This paper is a technical overview of the Session Initiation Protocol and is designed for IT professionals, managers, and architects

The feature allows embedded messages of the Session Initiation Protocol (SIP) passing through a device that is configured with Network Address Translation (NAT) to be translated and encoded back to the

ii Voice over IP Security Patrick Park Copyright 2009 Cisco Systems, Inc. Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved. No part of this book may be reproduced

This specification describes the situation of the Proximus network and services. It will be subject to modifications for corrections or when the network or the services will be modified. Please take into

Attack Sandro Gauci Difficulty VoIP is a hot and steadily gaining market share in the phone business. As people constantly seek to make long distance calls cheaper, they are moving away from relying on

Implementing VoIP monitoring solutions Deployment note Introduction With VoIP being an integral part of modern day business communications, enterprises are placing greater emphasis on the monitoring and

Introduction Voice Over IP and Firewalls By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com Use of Voice Over IP (VoIP) in enterprises is becoming more and more